Ziyad Mohammad Mansy Ibrahim

Beyond Sanitizers: LLM-Guided Refinement for Differential JSON Deserialization Testing in Dart

A prior black-box, LLM-guided grammar-fuzzing pipeline raised a native C parser's acceptance rate from 58.2% to 97.1% using only coverage-free feedback, and named a memory-safe target – where "crash" has no sanitizer-based meaning – as future work. We take up that challenge, reta...

Coverage-Free Fuzzing: LLM-Guided Refinement of Grammar-Based Test Generators

Property-based testing tools such as Hypothesis can turn a formal grammar into a generator of syntactically valid inputs, but the generator itself is typically static: hand-tuned once and reused unchanged for the rest of a fuzzing campaign. We study whether a large language model...

Where Does an LLM Fuzzer's Domain Knowledge Come From? Human, Code-Read, and Self-Acquired Knowledge for Differential Testing of Typed Deserializers

An LLM-guided refinement loop for differential testing of Dart JSON deserializers found divergence in 2.9% of generated documents on its own and in 28.8% when given four observations from a manual characterization: the bottleneck was domain knowledge. We ask whether the fuzzer ca...

Where Does an LLM Fuzzer's Domain Knowledge Come From? Human, Code-Read, and Self-Acquired Knowledge for Differential Testing of Typed Deserializers

An LLM-guided refinement loop for differential testing of Dart JSON deserializers found divergence in 2.9% of generated documents on its own and in 28.8% when given four observations from a human characterization: the bottleneck was domain knowledge. We ask whether the fuzzer can...

Beyond Sanitizers: LLM-Guided Refinement for Differential JSON Deserialization Testing in Dart

A prior black-box, LLM-guided grammar-fuzzing pipeline raised a native C parser's acceptance rate from 58.2% to 97.1% using only coverage-free feedback, and named a memory-safe target — where "crash" has no sanitizer-based meaning — as future work. We take up that challenge, reta...

Beyond Sanitizers: LLM-Guided Refinement for Differential JSON Deserialization Testing in Dart

A prior black-box, LLM-guided grammar-fuzzing pipeline raised a native C parser’s acceptance rate from 58.2% to 97.1% using only coverage-free feedback, and named a memory-safe target – where “crash” has no sanitizer-based meaning – as future work along a materially different gen...

Coverage-Free Fuzzing: LLM-Guided Refinement of Grammar-Based Test Generators

Property-based testing tools such as Hypothesis can turn a formal grammar into a generator of syntactically valid inputs, but the generator itself is typically static: hand-tuned once and reused unchanged for the rest of a fuzzing campaign. We study whether a large language model...